Microsoft warns of attacks delivering FlawedAmmyy RAT directly in memory

Researchers at Microsoft uncovered a malicious campaign that delivers the infamous FlawedAmmyy RAT directly in memory.

Experts at Microsoft uncovered a malicious campaign that delivers the FlawedAmmyy RAT directly in memory.

The FlawedAMMYY backdoor borrows the code of the Ammyy Admin remote access Trojan, it allows attackers to get full access to a victim’s machine. FlawedAmmyy RAT allows stealing sensitive data from infected systems and exfiltrating files.

FlawedAmmyy Remote Access Trojan was involved in attacks carried out by the threat actors tracked as TA505.

Microsoft observed weaponized spam messages using .xls attachments with content in Korean. The macro included in the documents executes the legitimate msiexec.exe tool that downloads an MSI archive.

The MSI archive includes a digitally signed executable that decrypts and execute another executable in memory once it is opened.

Anomaly detection helped us uncover a new campaign that employs a complex infection chain to download and run the notorious FlawedAmmyy RAT directly in memory. The attack starts with an email and .xls attachment with content in the Korean language. pic.twitter.com/PQ2g7rvDQm

— Microsoft Threat Intelligence (@MsftSecIntel) June 21, 2019

This executable then downloads and decrypts another file, wsus.exe, which was also digitally signed on June 19. wsus.exe decrypts and runs the final payload directly in memory. The final payload is the remote access Trojan FlawedAmmyy.

— Microsoft Threat Intelligence (@MsftSecIntel) June 21, 2019

“This executable then downloads and decrypts another file, wsus.exe, which was also digitally signed on June 19. wsus.exe decrypts and runs the final payload directly in memory. The final payload is the remote access Trojan FlawedAmmyy,” reads a Tweet published by Microsoft Security Intelligence.

One of the samples involved in this campaign, detected on June 22, was digitally signed using a certificate issued by Thawte for Dream Body Limited.

2019-06-22: 📺#FlawedAmmyy #RAT 👾🐀 | #Signed
Digital Cert 🔏-> [Dream Body Limited] #Thawte
C2: 169.239.128. 185
h/t @malwrhunterteam
🔦Recompiled AmmyAdmin v3🤔
Seems every day they leverage new malware signing 📈certs for campaigns in🇰🇷
MD5: fb5a09e073324e99b979831a98b120b0 pic.twitter.com/oYT96blamA

— Vitali Kremez (@VK_Intel) June 22, 2019

In May, experts at Yoroi-Cybaze Z-Lab observed a spike in the number of attacks against the banking sector and spotted a new email stealer used by the TA505 hacker group.

Earlier June, researchers at Trend Micro observed the TA505 group carrying out attacks, involving the FlawedAmmyy RAT and other RATs, against users in Latin America and Asia.

[adrotate banner=”9″]

[adrotate banner=”12″]

Pierluigi Paganini

(SecurityAffairs – FlawedAmmyy, malware)

[adrotate banner=”5″]

[adrotate banner=”13″]